Definition 2 (Probabilistic robustness, [1]}) 
Let \(T\)  be the transformation of general type and \(x\)  be the input sample with ground truth class \(c\) . Suppose that \(\mathbb {S}_T(x)\)  is the space of all images \(x_T\)  of \(x\)  under perturbations induced by \(T\)  and \(\mathbb {P}\)  be the probability measure on space \(\mathbb {S}_T(x)\) .
The \(K\) -class model \(f\)  is said to be robust at point \(x\)  with probability at least \(1-\epsilon \)  if
\(\displaystyle \mathbb {P}_{x_T \sim \mathbb {S}_\mathcal {T}(x)} \left( \operatornamewithlimits{\arg {}\,\max }_{k \in \lbrace 1, \dots , K\rbrace } f_k(x_T) = c \right) \ge 1-\epsilon .\) 

